Electromechanical brake systems, in particular for vehicles, are known, wherein the hydraulic brake actuator units provided to transmit the braking force to the brake disk connected to a wheel are replaced by high-performance electromechanical brake actuator units, which can be controlled and regulated electrically by a central control system disposed in the vehicle. Such electromechanical brake systems are also referred to as brake by wire systems. Such a brake actuator unit can be configured as a fully electronic, electro-hydraulic or electro-pneumatic unit.
The brake actuator unit is generally disposed together with at least one control device in a brake module, which is associated with a wheel of the vehicle. The brake actuator unit is activated by way of the control device associated with the brake actuator unit. The control device receives the control commands required to activate the brake actuator unit from the at least one control system disposed centrally in the vehicle, which generally activates four brake modules associated with the respective wheels in a common manner.
By actuating an actuation element provided in the vehicle, for example a brake pedal, at least one electronic brake signal is generated, which is transmitted to the central control system and activation of the respective control device and thus the associated brake actuator unit is effected as a function thereof.
One important criterion for the described electromechanical brake system is the identification, elimination and control of system faults occurring in the central control system and/or in the brake modules and/or in the energy supply to the cited components, which can threaten the availability of the electromechanical brake system and thus the safety of the occupants of the vehicle.
Such electromechanical brake systems frequently have auxiliary brake functions, by way of which actuation on controlled stages (secondary braking) of individual undamaged brake actuator units is still possible even after the occurrence of a fault. In known brake systems in addition to actuation of the service brake it is also possible to brake the vehicle using the parking brake, in other words if one of the components affecting the service brake fails, it is still possible to carry out secondary braking by way of the actuation element of the parking brake.
Numerous designs for achieving “one fault tolerant” electromechanical brake systems are already known from the prior art. For example WO 99/26820 describes an electromechanical brake system, the central control unit of which has three computer units, the output signals of which are checked in respect of plausibility by means of a voter unit. If the control signal of one of the computer units deviates from the control signals generated by the further computer units, it is identified as faulty by means of the voter unit and the defective computer unit is excluded from further signal processing. This should prevent activation of the brake modules by means of defective control signals. If a second fault now occurs in the form of the failure of the voter unit, further reliable actuation of the brake system is no longer possible, in other words a further second fault can result in the failure of the entire electromechanical brake system.
With hydraulic brake systems in particular it is already known that the brake circuits within the vehicle can be divided up to increase fault tolerance. Similarly the brake circuit of the electromechanical brake system can be broken down into at least two brake circuits, in other words brake modules associated with at least two different wheels respectively are combined to form one functional unit and are activated in a common manner. For example the brake modules associated with diagonally opposing wheels can respectively form one functional unit. If one of said functional units fails, it is possible to continue braking by way of the brake actuator units of the functioning functional unit, in other words secondary braking is ensured by actuating one of the two brake circuits of the service brake.
To supply the individual control devices and brake actuator units of the brake modules of the electromechanical brake system with electrical energy, in particularly the necessary operating voltage or current strength, these are connected respectively for example by way of separate energy supply lines to a main energy supply unit. In addition to the main energy supply unit provision is made in known systems for at least one emergency energy supply unit, which absorbs a failure of the main energy supply unit and in the event of a fault the energy supply to at least the safety-related elements of the electromechanical brake system is taken over by the emergency energy supply unit.
By disconnecting the energy supply it is also possible to disconnect a defective brake module within the electromechanical brake system and the energy supply to the brake actuator unit or the associated control device is also interrupted. The brake module which has been switched to be without current or voltage then opens automatically. In particular if a second fault occurs, incorrect actuation of a brake module may take place, with the result that an undesirable braking force is generated. In this instance controlled opening of the service brake is no longer possible by way of the associated control device, in other words the service brake brakes unexpectedly or locks, thereby endangering the drive stability of the vehicle. Specific disconnection of the energy supply allows such faults to be eliminated even if a first and second system fault for example occur within the control device associated with the individual wheel. The remaining functioning brake modules are advantageously available for secondary braking and therefore controlled slowing of the vehicle.
With conventional electromechanical brake systems two independent energy supply lines respectively are provided for each brake module to supply the brake actuator unit and the control device. Two independent switching paths are therefore available to disconnect the energy supply to one brake module in each instance. For the entire electromechanical brake system therefore eight power supply lines have to be monitored by means of for example eight voter units to achieve a “two fault tolerance”, in other words one voter unit has to be provided for each supply line. This involves a high control and/or component outlay.